In the Linux kernel, the following vulnerability has been resolved: can: dev: can_restart: fix use after free bug After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len; Reordering the lines solves the issue.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.11:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.11:rc4:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/03f16c5075b22c8902d2af739969e878b0879c94 cve-icon cve-icon
https://git.kernel.org/stable/c/08ab951787098ae0b6c0364aeea7a8138226f234 cve-icon cve-icon
https://git.kernel.org/stable/c/260925a0b7d2da5449f8ecfd02c1405e0c8a45b8 cve-icon cve-icon
https://git.kernel.org/stable/c/593c072b7b3c4d7044416eb039d9ad706bedd67a cve-icon cve-icon
https://git.kernel.org/stable/c/92668d28c7e6a7a2ba07df287669ffcdf650c421 cve-icon cve-icon
https://git.kernel.org/stable/c/ac48ef15826e83f4206c47add61072e8fc76d328 cve-icon cve-icon
https://git.kernel.org/stable/c/bbc6847b9b8978b520f62fbc7c68c54ef0f8d282 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025041734-CVE-2021-47668-c0de@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-47668 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-47668 cve-icon
History

Mon, 21 Apr 2025 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.11:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.11:rc4:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Sat, 19 Apr 2025 01:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 17 Apr 2025 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Apr 2025 18:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: can: dev: can_restart: fix use after free bug After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len; Reordering the lines solves the issue.
Title can: dev: can_restart: fix use after free bug
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-04-17T18:01:29.315Z

Updated: 2025-04-17T18:25:25.427Z

Reserved: 2025-04-16T07:16:05.752Z

Link: CVE-2021-47668

cve-icon Vulnrichment

Updated: 2025-04-17T18:17:58.458Z

cve-icon NVD

Status : Analyzed

Published: 2025-04-17T18:15:43.623

Modified: 2025-04-21T18:41:27.987

Link: CVE-2021-47668

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-04-17T00:00:00Z

Links: CVE-2021-47668 - Bugzilla